---
id: "CVE-2026-111966"
kind: "vulnerability"
aliases: ["CVE-2026-111966"]
title: "User Profile Builder WordPress plugin: shortcode attribute enables stored XSS"
severity: "medium"
cvss: 6.8
epss: 0.00153
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "user-profile-builder", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "plugin-version-4.0.5-or-later"]
published_at: "2026-10-23T06:17:05+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:42:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111966", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111966", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# User Profile Builder WordPress plugin: shortcode attribute enables stored XSS

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise or escape one shortcode attribute before printing it in a redirect message. A contributor-level user can store a script that runs in the browser of a higher-privileged user who submits the affected form.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get user-profile-builder --field=version`
- Review whether contributor or similar low-privilege accounts can create content that embeds the plugin's shortcodes

## Fix

- Update User Profile Builder to `4.0.5` or later

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111966
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111966

## From the sources

The User Profile Builder  WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_